Polynomial Protocol contest - Diana's results

Lines of code

https://github.com/code-423n4/2023-03-polynomial/blob/main/src/KangarooVault.sol#L183 https://github.com/code-423n4/2023-03-polynomial/blob/main/src/KangarooVault.sol#L215 https://github.com/code-423n4/2023-03-polynomial/blob/main/src/KangarooVault.sol#L243 https://github.com/code-423n4/2023-03-polynomial/blob/main/src/KangarooVault.sol#L269

Vulnerability details

Impact

In LiquidityPool.sol, all deposit and withdraw functions contain the whenNotPaused modifier (For instance deposit(), queueDeposit(), processDeposits(), withdraw(), queueWithdraw(), processWithdraws()), while KangarooVault.sol also inherits from PauseModifier but the functions initiateDeposit(), initiateWithdrawal(), processDepositQueue() and processWithdrawalQueue() do not have the whenNotPaused modifier set.

All functions to deposit and withdraw should contain the same modifiers to stop transactions while paused.

Example with modifier https://github.com/code-423n4/2023-03-polynomial/blob/main/src/LiquidityPool.sol#L200-L204

function queueDeposit(uint256 amount, address user)
        external
        override
        nonReentrant
        whenNotPaused("POOL_QUEUE_DEPOSIT")

Proof of Concept

Users can use all the following functions initiateDeposit(), initiateWithdrawal(), processDepositQueue() and processWithdrawalQueue() to initiate deposit/withdrawal etc even when the contract is paused. Similar to the deposit and withdrawal functions in LiquidityPool.sol, these functions should contain the same modifier

https://github.com/code-423n4/2023-03-polynomial/blob/main/src/KangarooVault.sol#L183

function initiateDeposit(address user, uint256 amount) external nonReentrant {

https://github.com/code-423n4/2023-03-polynomial/blob/main/src/KangarooVault.sol#L215

function initiateWithdrawal(address user, uint256 tokens) external nonReentrant {

https://github.com/code-423n4/2023-03-polynomial/blob/main/src/KangarooVault.sol#L243

function processDepositQueue(uint256 idCount) external nonReentrant {

https://github.com/code-423n4/2023-03-polynomial/blob/main/src/KangarooVault.sol#L269

function processWithdrawalQueue(uint256 idCount) external nonReentrant {

Recommended Mitigation Steps

Add the whenNotPaused modifier to all functions that perform deposit and withdraw.